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This public-key cryptosystem endocing technique uses a mixing system 
based on polynomial algebra and recuction modulo two numbers while the 
decoding technique uses an unmixing system whose validity depends on 
elementary probability theory. A method for encoding and decoding a digital 
message comprises the steps: selecting ideals p and q of a ring R (305); 
generating elements f and g of the ring R (325), and generating an element 
F sub q which is an inverse of f (nod q), and generating F sub p which is an 
inverse off (mod p) (340); producing a public key that includes h (3S0)» where 
h is congruent, mod q, to a product that can be derived using g and F sub q; 
producing a private key from which f and F sub p can be derived; producing an 
encoded message by encoding the message using the public key and a rmidom 
element; and producing a decoded message by decoding tiie encoded message 
using the private key. 
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PUBLIC KEY CRYPTOSYSTEM METHOD AND APPARATUS 
RELATED APPLICATION 

This application claims priority from U.S. Provisional 
Patent Application Number 60/024,133, filed August 19, 1996, 
and said Provisional Patent Application is incorporated herein 
by reference. 

FIELD OF THE INVENTION 

This invention relates to encoding and decoding of 
information and, more particularly, to a public key 
cryptosystem for encryption and decryption of digital messages 
by processor systems. 

BACKGROUND OF THE INVENTION 

Secure exchange of data between two parties, for example, 
between two computers, requires encryption. There are two 
general methods of encryption in use today, private key 
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encryption and public key encryption. In private key 
encryption, the two parties privately exchange the keys to be 
used for encoding and decoding. A widely used example of a 
private key cryptosystem is DES, the Data Encryption Standard. 
Such systems can be very fast and very secure, but they suffer 
the disadvantage that the two parties must exchange their keys 
privately . 

A public key cryptosystem is one in which each party can 
publish their encoding process without compromising the 
security of the decoding process . The encoding process is 
popularly called a trap-door function. Public key 
c ryp to sys terns , although generally slower than private key 
cryptosystems , are used for transmitting small amounts of 
data, such as credit card numbers, and also to transmit a 
private key which is then used for private key encoding. 

Heretofore a variety of trap-door functions have been 
proposed and implemented for public key cryptosystems . 

One type of trap-door function which has been used to 
create public key cryptosystems involves exponentiation in a 
group; that is, taking an element of a group and repeatedly 
multiplying the element by itself using the group operation. 
The group most often chosen is the multiplicative group modulo 
pq for large prime numbers p and q , although other groups such 
as elliptic curves, abelian varieties, and even non- 
commutative matrix groups, have been described. However, this 
type of trap-door function requires large prime numbers, on 
the order of 100 digits each, making key creation cumbersome; 
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and the exponentiation process used for encoding and decoding 
is computationally intensive, requiring many multiplications 
of hundred digit numbers and on the order of operations to 
encode or decode a message consisting of N bits. 

A second type of trap-door function which has been used 
to create public key cryptosystems is based on the difficulty 
of determining which numbers are squares in a group, usually 
the multiplicative group modulo pq for large primes p and q. 
Just as in the first type, key creation is cumbersome and 
encoding and decoding are computationally intensive, requiring 
on the order of N"^ operations to encode or decode a message 
consisting of N bits. 

A third type of trap- door function involves the discrete 
logarithm problem in a group, generally the multiplicative 
group or an elliptic curve modulo a large prime p. Again, key 
creation is cumbersome, since the prime p needs at least ISO 
digits and p - 1 must have a large prime factor; and such 
systems use exponentiation, so again require on the order of 
operations to encode or decode a message consisting of N bits. 

A fourth type of trap -door function which has been used 
to create public key cryptosystems is based on the knapsack, 
or subset sum, problem. These functions use a semigroup, 
normally the semigroup of positive integers under addition. 
Many public key cryptosystems of this type have been broken 
using lattice reduction techniques, so they are no longer 
considered secure systems. 

A fifth type of trap-door function which has been used to 
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create public key cryptosystems is based on error correcting 
codes, especially Goppa codes. These cryptosystems use linear 
algebra over a finite field, generally the field with two 
elements. There are linear algebra attacks on these 
cryptosystems, so the key for a secure cryptosystem is a large 
rectangular matrix, on the order of 400, 000 bits. This is too 
large for most applications. 

A sixth type of trap-door function which has been used to 
create public key cryptosystems is based on the difficulty of 
finding extremely short basis vectors in a lattice of large 
dimension N. The keys for such a system have length on the 
order of bits, which is too large for many applications. In 
addition, these lattice reduction public key cryptosystems are 
very new, so their security has not yet been fully analyzed. 

Most users, therefore, would find it desirsible to have a 
public key cryptosystem which combines relatively short, 
easily created keys with relatively high speed encoding and 
decoding processes . 

It is among the objects of the invention to provide a 
public key encryption system for which keys are relatively 
short and easily created and for which the encoding and 
decoding processes can be performed rapidly. It is also among 
the objects hereof to provide a public key encryption system 
which has relatively low memory requirements and which depends 
on a variety of parameters that permit substantial flexibility 
in balancing security level, key length, encoding and decoding 
speed, memory requirements, and bandwidth. 
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SUMMARY OF THE INVENTION 

The invention allows keys to be chosen essentially at 
random from a large set of vectors, with key lengths 
comparable to the key lengths in other common public key 
crypto systems, and features an appropriate (e.g. «« 2" for 
current circumstances) security level, and provides encoding 
and decoding processes which are between one and two orders of 
magnitude faster than the most widely used public key 
cryptosystem, namely the exponentiation cryptosystem 
referenced above . 

The encoding techniqu.e of an embodiment of the public key 
cryptosystem hereof uses a mixing system based on polynomial 
algebra and reduction modulo two numbers, p and q, while the 
decoding technique uses an unmixing system whose validity 
depends on elementary probability theory. The security of the 
public key cryptosystem hereof comes from the interaction of 
the polynomial mixing system with the independence of 
reduction modulo p and q. Security also relies on the 
experimentally observed fact that for most lattices , it is 
very difficult to find the shortest vector if there are a 
large number of vectors which are only moderately longer than 
the shortest vector. 

An embodiment of the invention is in the form of a method 
for encoding and decoding a digital message m, comprising the 
following steps: selecting ideals p and q of a ring R; 
generating elements f and g of the ring R, and generating 
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element which is an inverse of f (mod q) , and generating 
element Fp which is an inverse of f (mod p) ; producing a public 
key that includes h, where h is congruent, mod q, to a product 
that can be derived using g and F,; producing a private key 
from which f and Fp can be derived; producing an encoded 
message e by encoding the message m using the public key and a 
random element o ; and producing a decoded message by decoding 
the encoded message e using the private key. 

Further features and advantages of the invention will 
become more readily apparent from the following detailed 
description when taken in conjunction with the accompanying 
drawings . 
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RRTRF DF.SCRTPTTQTNJ OF THK DRAWTNC^S 

Figure 1 is a block diagram of a system that can be used 
in practicing embodiments of the invention. 

Figure 2 is a flow diagram of a public key encryption 
system which, when taken with the subsidiary flow diagrams 
referred to therein, can be used in implementing embodiments 
of the invention . 

Figure 3 is a flow diagram of a routine, in accordance 
with an embodiment of the invention, for generating public and 
private keys . 

Figure 4 is a flow diagram in accordance with an 
embodiment of the invention, for encoding a message using a 
public key. 

Figure 5 is a flow diagram in accordance with an 
embodiment of the invention, for decoding an encoded message 
using a private key. 

Figure 6 is a flow diagram of a routine, in accordance 
with another embodiment of the invention, for generating 
public and private keys . 

Figure 7 is a flow diagram in accordance with another 
embodiment of the invention, for encoding a message using a 
public key. 

Figure 8 is a flow diagram in accordance with another 
embodiment of the invention, for decoding an encoded message 
using a private key. 
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DETAILED DESCRIPTION 



Figure 1 is a block diagram of a system that can be used 
in practicing embodiments of the invention. Two processor- 
based subsystems 105 and 155 are shown as being in 
communication over an insecure channel 50, which may be, for 
example, any .wired or wireless communication channel such as a 
telephone or internet communication channel . The subsystem 
105 includes processor 110 and the subsystem 155 includes 
processor 160. When programmed in the manner to be described, 
the processors 110 and 160 and their associated circuits can 
be used to implement an embodiment of the invention and to 
practice an embodiment of the method of the invention. The 
processors 110 and 160 may each be any suitable processor, for 
example an electronic digital processor or microprocessor. It 
will be understood that any general purpose or special purpose 
processor, or other machine or circuitry that can perform the 
functions described herein, electronically, optically, or by 
other means, can be utilized. The processors may be, for 
example, Intel Pentium processors. The subsystem 105 will 
typically include memories 12 3, clock and timing circuitry 
121, input /output functions 118 and monitor 12 5, which may all 
be of conventional types . Inputs can include a keyboard input 
as represented at 103. Communication is via transceiver 13 5, 
which may comprise a modem or any suitable device for 
communicating signals. 

The subsystem 155 in this illustrative embodiment can 
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have a similar configuration to that of subsystem 105. The 
processor 160 has associated input/output circuitry 164, 
memories 168, clock and timing circuitry 173, and a monitor 
176. Inputs include a keyboard 15 5. Communication of 
subsystem 155 with the outside world is via transceiver 162 
which, again, may comprise a modem or any suitable device for 
communicating signals. 

The encoding technique of an embodiment of the public key 
cryptosystem hereof uses a mixing system based on polynomial 
algebra and reduction modulo two numbers , p and while the 
decoding technique uses an unmixing system whose validity 
depends on elementary probability theory. [It will be 
understood that the polynomial is a convenient representation 
of ordered coefficients (a polynomial of degree N-1 having N 
ordered coefficients, some of which may be zero) , and that the 
processor will perform designated operations on coefficients.] 
The security of the public key cryptosystem hereof comes from 
the interaction of the polynomial mixing system with the 
independence of reduction modulo p and q. Security also 
relies on the experimentally observed fact that for most 
lattices, it is very difficult to find the shortest vector if 
there are a large number 

of vectors which are only moderately longer than the shortest vector. 

The cryptosystem hereof fits into the general framework 
of a probabilistic cryptosystem as described in M. Blum et 
al . , "An Efficient Probabilistic Public-Key Encryption Scheme 
Which Hides All Partial Information", Advances in Cryptology: 
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Proceedings of CRYPTO 84, Lecture Notes in Computer Science, 
Vol, 19 6, Springer-Verlag, 1985, pp. 2 89-2 99 ; and S. 
Goldwasser et al . , "Probabilistic Encryption", J. Computer and 
Systems Science 28 (1984), 270-299. This means that 
encryption includes a random element, so each message has many 
possible encryptions. Encoding and decoding and key creation 
are relatively fast and easy using the technique hereof, in 
which it takes O(N^) operations to encode or decode a message 
block of length N, making it considerably faster than the 0 (N^) 
operations required by RSA. Key lengths are O (N) , which 
compares well with the O(N^) key lengths required by other 
"fast" public keys systems such as those described in R.J. 
McEliece, "A Public-Key Cryptosystem Based On Algebraic Coding 
Theory", JPL Pasadena, DSN Progress Reports 42-44 (1978), 114- 
116 and 0 . Goldreich et al . "Public-Key Cryptosystems From 
Lattice Reduction Problems", MIT - Laboratory for Computer 
Science preprint, November 1996. 

An embodiment of the cryptosystem hereof depends on four 
integer parameters {N,K,p,q> and three sets iCq, of 
polynomials of degree N-l with integer coefficients. This 
embodiment works in the ring R = Z[X]/(X^-1) . An element F e R 
will be written as a polynomial or a vector, 

N 

The star "*" denotes multiplication in R. This star 
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multiplication is given explicitly as a cyclic convolution 
product, F * G = H with 



When a multiplication modulo (say) q is performed, the 
coefficients are reduced modulo q. Further reference can be 
made to Appendix 1 . 

The following is an example of an embodiment in 
accordance with the invention of a public key cryptosystem. 
Very small numbers are used for ease of illustration, so the 
example would not be cryptographically secure. In conjunction 
with the example there is described, as material in double 
brackets (J J ) , operating parameters that would provide a 
practical cryptographically secure cryptosystem under current 
conditions. Further discussion of the operating parameters to 
achieve a particular level of security is set forth in 
Appendix 1, which also describes the degree of immunity of an 
embodiment of the cryptosystem hereof to various types of 
attack . 

The objects used in an embodiment hereof are polynomials 
of degree N-1, 



where the coefficients a.,,..., a., are integers. In the "star" 
multiplication hereof, is replaced by 1, and x"*^ is replaced 
by X, and x*^'^ is replaced by x^, and so on. [A polynomial may 



It 




a^x" ^ + ajx*'-^* + - + ix + a„. 
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also be represented by an N-tuple of numbers 

In such, case the star product is also known as the convolution 
product. For large values of N, it may be faster to compute 
convolution products using the method of Fast Fourier 
Transforms, which take on the order of NlogN steps instead of 

steps.] For example, taking N=5, and two exemplary 
polynomials, the star multiplication gives 
(x^+2x^-3x+2) * (2x'*+3x^ + 5x-l) 

=.2x'' + 3x%4xS5x=-6x^ + 16x'-17x' + 13x-2 
«2x^ + 3x= + 4x+5x-6x'* + 16x^-17x^ + 13x-2 
= - 6xVl8x^-14x^+17x+3 

[a secure system may use, for example N = 167 or N = 263.1 
[This embodiment uses the ring of polynomials with integer 
coefficients modulo the ideal consisting of all multiples of 3^ 
-1, More generally, one could use polynomials modulo a 
different ideal; and even more generally, one could use some 
other ring R. For further information on rings and ideals, 
reference can be made, for example, to Topics in Algebra by 
I .N . Herstein.] 

Another aspect of the present embodiment involves 
reducing the coefficients of a polynomial modulo an integer, 
such as the ideal q. This essentially means dividing each 
coefficient by q and replacing the coefficient with its 
remainder. For example, if q = 128 and if some coefficient is 
23 77, then that coefficient would be replaced with 73, because 
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2311 divided by 128 equals 18, with a remainder of 73. 
However, it is easier to use "centered remainders." This 
means that if the remainder is between 0 and q/2/ it is left 
alone, but if it is between q/2 and q, then q is subtracted 
from it. Accordingly, using centered reminders for q = 12 8, 
2377 would be replaced by -55, since -55 = 73 - 128. 

To indicate that this remainder process is being 
performed, a triple equal sign ( = ) is used, along with the 
designation "mod q." The following is an example which 
combines star multiplication of two polynomials with reduction 
modulo 5 . The answer uses centered remainders . 

(xV2x2-3x+2)* (2x*+3x^+5x-l) = - 6x*+18x^- 14x2+17x+3 

= -x*-2x^+x^+2X-2 (mod 5) . 

In creating a public key crypt ©system in accordance with 
an embodiment hereof (and with the previously indicated small 
numbers for ease of illustration) , a first step is to choose 
integer parameters N, K, p, and q. Take, for example 

N = 5, K = 1, p = 3, q = 128. 
(a secure system may use, for example, N=167, K*6, p=3 , q=2^* = 
65536.1 Preferably, p and q will be relatively prime; that 
is, they will have no common factors greater than 1. A 
discussion of the desirability of having the ideals p and q be 
relatively prime is set forth in Appendix 1 . 
Some sets of polynomials are chosen, as follows: 
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= {polynomials whose coefficients are -2's, -I's, O's, 
I's, and 2's) 

^» = {polynomials with, two -I's, two I's, and one 0 as 
coefficients ) 

= {polynomials whose coefficients are -I's, O's, and 

I's} 

[a secure system may use, for example 

2g = {polynomials whose coefficients lie between -177 and 
177) 

^9 = {polynomials whose coefficients are forty I's, forty 
-I's, the rest O's} 
= {polynomials whose coefficients lie between -3 and 3} 
(Note: The polynomials have degree N-1, so for the secure 
parameters of the example, the polynomials have degree 166. 
Further, the actual message m being encoded consists of the 
remainders when the coefficients of m are divided by p, where 
in this example p = 3 . ) ] 

The set i£g is used to create the key for the crypto system, 
the set is used for encoding messages, and the set is the 
set of possible messages. For example, 

2x*-x^+x-2 is in the set i£g , and 
x*-x^-x^+l is in the set 
To implement the key creation of this example, the key 
creator, call him Dan, chooses two polynomials £ and g from 
the set 2^. In this simplified example K = 1, so there is one 
polynomial g . Suppose that Dan chooses 
f = x'*-x^+2x^-2x+l, 
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g = x^-x^+x^- 2x+2 . 
[a secure system may use, for example, K + 1 polynomials f, 
gw ■ ■ • e ifig with K = 6.1 

A requirement hereof is that f must have an inverse 
modulo q and an inverse modulo p. What this means is that 
there must be polynomials Fq and F, so that 

Fq * t m 1 (mod q) and Fp * f s 1 (mod p) . 
The well known Euclidean algorithm can be used to compute F, 
and F, . Reference can be made, for example, to Appendix II 
hereof. (Some f s may not have inverses, in which case Dan 
would have to go back and choose another f . ) For the above 
example f , we have 

Fq = 103x* + 29x^ + 116x2 + 793^ + 53, 

Fp = 2x* + 2x. 

To check that .this is the right F, for f , one can multiply 
Fq * f = (103x'*+29x^+116x^+79x+58) * (x^-x^+2x2-2x+l ) 
= 256x* + 256x - 127 

s 1 (mod 128) . 

Similarly, to check that Fp is correct, one can multiply 
Fp * f = (2x* + 2x)* (x* - x^+ 2x2 _ 2x + 1) 
= 6x^ - 6x^ + 6x - 2 
s 1 (mod 3) . 

Now, the key creator Dan is ready to create his public 
key, which is the polynomial h given by 

h B Fq * g (mod q) . 
I A secure system may use, for example, K polynomials h, ,. . . jh^ 
given by 
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J^i = * gi (mod q) with i = 1, 2 , . . . , K, 

with K = 6 . J 

Continuing with the example, Dan would compute 

Fg * g = (103x^+29x^+116x2+79x+58) * (x*-x^+x=-2x+2 ) 
= 243X* - 50x^ + 58x^ + 232x - 98 
s -13x* - 50x^ + 58x^ - 24x + 30 (mod 128) . 
Then Dan's public key is the polynomial 

h = - 13x* - 50x' + 58x^ -24x + 30. 
Dan's private key is the pair of polynomials (f^ Fp) . In 
principle, the polynomial f itself can function as the private 
key, because Fp can always be computed from f ; but in practice 
Dan would probably want to precompute and save Pp. 

In the next part of the example, encoding with the public 
key is described. Suppose the encoder, call her Cathy, wants 
to send Dan a message using his public key h. She chooses a 
message from the set of possible message 5C^. For example, 
suppose that she wants to send the message 

m = X* - x^ + x^ + 1, 
To encode this message, she chooses at random a polynomial o 
from the set iC^. For example, say she selects 

0 = - + x^ - x^ + 1 . 
She uses this randomly chosen polynomial Dan's public key h 
(as well as p and q, which are part of the public key) , and 
her plaintext message m to create the encoded message e using 
the formula 

e s p0 * h + m (mod q) . 
[A secure system may use K public keys h^, . . .,hn, with K = 6 
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for the secure example. To encode a message, Cathy can 
randomly choose K polynomials . . . , o, from the set and 
then create the encoded message e by computing e s 
p(2>i*hi+p02*h2+ ■ . - +p0K**iK+tn (mod q) . 1 An alternative would 

be to let h equal pFq*g (mod q) , and then the message can be 
encoded using the formula e s 0*h+m (mod q) . For the present 
example, Cathy computes 

p0 * h + m = 3(-x*+x^-x=+l) * (-13x*-'50x* + 58x*-24x+30) 

+ (x* - + x^ + 1) 
= -374x' + 50x^ + 196x^ - 357x + 487 
s lOx^ + 50x^ - GOx^ + 27x - 25 (mod 128) . 
So Cathy's encoded message is the polynomial 

e >^ lOx* + 50x^ - 60x= + 27x - 25, 
and she sends this encoded message to Dan. 

In the next part of the example, decoding using the 
private key is described. In order to decode the message e, 
Dan first uses his private key t to compute the polynomial 

a s f * e (mod q) . 
For the example being used, he computes 

f * e = (x*-x^+2x2-2x+l) * (10x* + 50x^-60x2+27x-25) 
= -262x* + 259x^ - 124x^ - 13x + 142 
E -6x* + 3x^ + 4x2 . 3^33^ + 14 (^q^^ 128), 
so the polynomial a is 

a = -6X* + 3x^ + 4x= - 13x + 14. 
Next, Dan uses F,, the other half of his private key, to 
compute 

Fp * a (mod p) , 
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and the result will be the decoded message. Thus for the 
present example, Dan computes 

Fp * a = + 2x) * (-6X* + 3x^ + _ 2.3yi + 14) 

= 34x* - 4X^ - 20X^ + 36x - 38 
55 X* - + + 1 (mod 3) . 
Reference can be made to Appendix I for further description of 
why the decoding works . 

In a further embodiment of the invention the ring is a 
ring of matrices. For example, one can use the ring 

R = (the ring of M x M matrices with integer 
coefficients) . 
An element of R looks like 

^^Ml ^M2 '" ^MMJ 

where the coefficients a.^^ are integers . Addition and 
multiplication are as usual for matrices, and it will be 
understood that the processor can treat the matrix members as 
numbers stored and operated on in any convenient manner. Let 

N = M^, so a matrix in R has N coefficients. Relatively 
prime integers p and q are chosen. 

In this case, to create a private key, Dan chooses K + 2 
matrices from R , These matrices can be called 

f .g,wi,w2, . . . , Wk- 

These matrices should have the property that f ,g,Wi, . . . .w^ have 
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fairly small coefficients, and every satisfies 

Wi s 0 (mod p) . 

(In other words, every coefficient of every is a multiple of 
p^) To create his key, Dan needs to find inverses for f and g 
modulo p and q. Thus he finds matrices Fp,F,,G,,Gq in R 
satisfying 

fFp E I (mod p) 
fFq 3 I (mod q) 

gGp = I (mod p} 
gGq s I (mod q) 

where I is the M x M identity matrix. In general, this is 
quite easy to do; and if by some chance one of the inverses 
fail to exist, Dan just chooses a new f or g. 

Dan's public key is a list of K matrices (h^^hj, . . . r h^) 
determined by the condition 

hi = FqWiGq (mod q) for i = 1 , 2, . . , , K. 
(Note that the w^'s are congruent to zero modulo p.) His 
private key is the four matrices (f ,g/Fp,Gp) . In principle, f 
and g alone can be used as the private key, but in practice it 
is more efficient to precompute and store Fp, G, . 

The encoding for this matrix example is described next. 
Suppose that Cathy wants to encode a message m. The message m 
is a matrix with coefficients modulo p. In order to encode 
her message, she chooses at random some integers 0^, . . . ,o, 
satisfying some condition; for example, they might be chosen 
to be non-negative integers whose sum e>i+. . . +o, equals a 
predetermined value d . (Note that the 0; ' s are ordinary 
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integers, they are not matrices. Equivalently , they can be 
thought of as multiples of the identity matrix, so they will 
commute with every element of the ring R.) 

Having chosen her iz^'s, Cathy creates her encoded message 
e by the rule 

e s a^hi^ + 02^2 +■■■"•■ Or^k ■•■ n\ (mod q) . 

The decoding for this matrix example is described next . 
We now assume that Dan has received the encoded message e and 
wishes to decipher it . He begins by computing the matrix a 
satisfying 

a = feg (mod q) . 
As usual, Dan chooses the coefficients of a in some restricted 
range, such as from -q/2 to q/2 (i.e., zero-centered 
coefficients), or from 0 to q-1. 

If the parameters have been chosen appropriately, then 
the matrix a will be exactly equal to the sum 
a = 0iWi + 02^2 + ■ - • ^K^K + f nig . 
(This will always be true modulo q, but a key point is that if 
q is large enough, then it will be an exact equality, not 
merely modulo q.) Dan's next step is to reduce a modulo p, say 

b s a (mod p) . 

Since all of the coefficients of the w^' s are divisible by p, 
this means that 

b s fmg (mod p) . 

Finally Dan computes 

PpbGp (mod p) 
to recover the original message m. 
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The described M x M matrix embodiment has excellent 
operating time. Encoding requires only additions and takes on 
the order of operations . Decoding requires two matrix 
multiplications of M x M matrices, so takes on the order of M'^ 
operations. The message length is on the order of M^, so if N 
denotes the natural message length (i.e.; N = M^) , then the 
matrix embodiment requires O (N) steps to encode and oCN^'^) 
steps to decode. For comparison, the polynomial embodiment 
requires O(N^) steps to encode and O(N^) steps to decode, and 
the RSA public key system requires OCN-*) steps to encode and 
O(N^) steps to decode. 

A preliminary analysis suggests that the only natural 
lattice attacks on the matrix embodiment require using 
lattices whose dimension is N^+N (or larger) . This would be a 
significant security improvement over the 2N dimensional 
lattices used to attack the polynomial embodiment. 

In order to avoid brute- force (or potential meet-in-the- 
middle) attacks, it is necessary that the sample space for the 
0i's be fairly large, say between 2"° and 2^°°. However, this 
is not difficult to achieve. For example, if the a^'s are 
chosen non-negative with sum d, then the sample space has 

I ^-1 I d\ iK-1) ! 

elements. So if one takes K = 15 and d = 1024, for example, 
one gets a sample space with 2^°-^'^ elements. 

The public key size is KM^logj (q) bits, and the private 
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key size is 2M^log2<pq) bits. Both of these are of a practical 
size . 

Figure 2 illustrates a basic procedure that can be 
utilized with a public key encryption system, and refers to 
routines illustrated by other referenced flow diagrams which 
describe features in accordance with an embodiment of the 
invention. The block 210 represents the generating of the 
public key and private key information, and the "publishing" 
of the public key. The routine of an embodiment hereof is 
described in conjunction with the flow diagram of Figure 3 . 
In the present example, it can be assumed that this operation 
is performed at the processor system 105 . The public key 
information can be published; that is, made available to any 
member of the public or to any desired group from whom the 
private key holder desires to receive encrypted messages. 
Typically, although not necessarily, the public key may be 
made available at a central public key library facility or 
website where a directory of public key holders and their 
public keys are maintained. In the present example, it is 
assumed that the user of the processor system 155 wants to 
send a confidential message to the user of processor system 
105, and that the user of processor system 155 knows the 
published public key of the user of processor system 150. 

The block 22 0 represents the routine that can be used by 
the message sender (that is, in this example, the user of 
processor system 155) to encode the plaintext message using 
the public key of the intended message recipient. This 
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routine, in accordance with an embodiment of the invention, is 
described in conjunction with the flow diagram of Figure 4 . 
The encrypted message is then transmitted over the channel 50 
(Figure 1) . 

The block 2 60 of Figure 2 represents the routine for the 
decoding of the encrypted message to recover the plaintext 
message. In the present example, this function is performed 
by the user of the processor system 10 5, who employs the 
private key information. The decoding routine, for an 
embodiment of the invention, is described in conjunction with 
the flow diagram of Figure 5 . 

Referring now to Figure 3 , there is shown a flow diagram 
of the routine, as represented generally by the block 210 of 
Figure 2, for generating the public and private keys. The 
routine can be utilized, in the present example, for 
programming the processor 110 of the processor system 105 . 
The block 3 05 represents the choosing of integer parameters N, 
p, and q. As first described above, N determines the degree 
of the polynomials t and to be generated, and p and q are, 
respectively, the two ideals used in producing the star 
products. The block 315 represents the selection of K, which 
is the number of polynomials to be used. In the simplified 
example above, K was 1, and it was noted that a particular 
exemplary relatively secure system could use K = 6 . Next , the 
block 32 5 represents the choosing of random polynomials f , g, , 
. . .gx« The coefficients may, for example, be chosen using a 
random number generator, which can be implemented, in known 
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fashion, using available hardware or software. In the present 
embodiment, each of the processor systems is provided with a 
random number generator, designated by the blocks 130 and 185 
respectively, in Figure 1 . 

The block 340 represents application of the Euclidean 
algorithm to determine the inverses, Fq emd Fp, in the manner 
described above, for the previously selected polynomial f , if 
such inverses exist. If Fp, do not exist, the block 325 is 
re-entered, and a new polynomial f is chosen. The loop 330 is 
continued until polynomials are chosen for which the defined 
inverses can be computed. [The probability of the inverses 
existing for a given polynomial is relatively high, so a 
relatively small number of traversals through the loop 33 0 
will generally be expected before the condition is met . ] The 
block 35 0 is then entered, this block representing the 
computation of the public key, h in accordance with 
h = Fq*g (mod q) 

as first described above. [For K>1 , there will be public key 
components h^ for i = 1,2, ...,K.] As represented by the block 
3 60, the private key is retained as the polynomials f , F, , and 
the public key can then be published, as represented by the 
block 3 70. 

Figure 4 is a flow diagram, represented generally by the 
block 240 of Figure 2 , of a routine for programming a 
processor, such as the processor 160 of the processor system 
155 (Figure 1) to implement encoding of a plaintext message m. 
The message to be encoded is input (block 42 0) and a random 
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polynomial o is chosen (block 430) . [If K>1, then K random 
polynomials 01,03, . . • r 0k are chosen.) The polynomial can be 
from the set as described above, and the random 

coefficients can be selected by any hardware or software 
means, for example the random number generator 18 5. The 
encoded message, e, can then be computed (block 450) as 

e = pa»*h + m (mod q) . 

As first noted above, for K greater than 1, the encoded 
message would be e = p0j*hj^ + p02*h2 + .... + P^k*^^ + m (mod q) . 
The encoded message can be transmitted (block 4 60) over 
channel 50 to the keyholder who, in the present example, is 
the user of the processor system 105. 

Figure 5 is a flow diagram represented generally in 
Figure 2 by the block 2 60, of a routine in accordance with an 
embodiment of the invention for decoding the encrypted 
message. The block 530 represents the receiving of the 
encrypted message, e. The retained private key information, 
which includes the previously defined polynomials f and F,, and 
the integers N, p, and q, are fetched (block 5 50) . Next, the 
block 570 represents the computation of 

a s f *e (mod q) . 
The decoded message, designated here as m' , can then be 
computed (block 580) as 

m' H Fp*a (mod p) . 

Figures 6,7 and 8 are flow diagrams relating to the 
above -de scribed matrix embodiment . Figure 6 is a flow diagram 
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of the routine, as represented generally by the block 210 of 
Figure 2, for generating the public and private keys. As 
above, the routine can be utilized, in the present example, 
for programming the processor 110 of the processor system 105 . 
The block 60 5 represents the choosing of integer parameters N, 
p, and q, where N is the number of matrix coefficients, and p 
and q are relatively prime integers. The block 615 represents 
the selection of which determines the number of matrices. 
Next, the block 625 represents the choosing of random matrices 
f ,g,Wi, Wj, . . . ,w,^, with the requirement that Wi,W2, . . . , are all 
congruent to 0 modulo p. Again, the random number generator 
130 (Figure 1) can be used for this purpose. 

The block 640 represents determination of the previously 
defined matrices Fp, F^, Gp and G, . If these matrices do not 
exist, the block 625 is re-entered, and new matrices f and g 
are chosen. The loop 63 0 is continued until matrices are 
chosen for which the defined inverses can be computed. The 
block 6 50 is then entered, this block representing the 
computation of the public key, a list of K matrices 
(hj , h, , . . . , hj^) determined by the condition 

hi = F^WiGq (mod q) for i = 1,2,...,K. 
As represented by the block 660, the private key is retained 
as the matrices (f^ g, Fp, Gp) and the public key can then be 
published, as represented by the block 670. 

Figure 7 is a flow diagram, represented generally by the 
block 240 of Figure 2, of a routine for programming a 
processor, such as the processor 16 0 of the processor system 
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15 5 (Figure 1) to implement encoding of a plaintext message m 
using the technique of the present matrix embodiment . The 
message to be encoded is input (block 720) and the random 
integers o^, Oj, . . . , 0j, are chosen (block 730). The integers can 
be selected by the random number generator 18 5 (Figure 1) . 
The encoded message, e, can then be computed (block 750) as 

e = e>ihi + 02^2 ^ (mod q) . 

The encoded message can be transmitted (block 760) over 
channel 50, to the keyholder which, in the present example, is 
the user of the processor system 105. 

Figure 8 is a flow diagram represented generally in 
Figure 2 by the block 2 60, of a routine for decoding the 
encrypted message in accordance with the present matrix 
embodiment. The block 830 represents the receiving of the 
encrypted message, e . The retained private key information, 
which includes the previously defined F, g, Fp and G,, and the 
integers N, p, and q, are fetched (block 850) . Then, the 
block 8 70 represents the computation of 

a = feg (mod q) . 
Next, a is reduced modulo p to b (block 8 8 0) as 

b = a (mod p) . 
The decoded message is then computed (block 8 90) as 
m' s FpbGp (mod p) . 

The invention has been described with reference to 
particular preferred embodiments, but variations within the 
spirit and scope of the invention will occur to those skilled 
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in the art. For example, it will be understood that the 
public or private keys can be stored on any suitable media, 
for example a "smart card^, which can be provided with a 
microprocessor capable of perfornd.ng encoding and/ or decoding, 
so that encrypted messages can be communicated to and/or from 
the smart card . 
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NTRU: A RING-BASED PUBLIC KEY CRYPTOSYSTEM 



Jeffrey Hoffstein, Jill Piphbr, Joseph H. Silverman 

ABSTRACT. We describe NTRU, a new public key cryptosystem. NTRU 
features reasonably short, easily created keys, high speed, and low memory 
requirements. NTRU encoding and decoding uses a mixing system suggested 
by polynomial algebra combined with a clustering principle based on elemen- 
tary probability theory. The security of the NTRU cryptosystem comes from 
the interaction of the polynomial mixing system with the independence of 
reduction modulo two relatively prime integers p and q. 
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§0. Introduction 

There has been considerable interest in the creation of eflBcient and computationally 
inexpensive public key cryptosystems since DifiQe and Hellman [4] explained how such 
systems could be created using one-way functions. Currently, the most widely used pub- 
lic key system is RSA, which was created by Rivest^ Shamir and Adelman in 1978 [10] 
and is based on the difficulty of factoring large numbers. Other systems include the 
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McEUece system [9] which rehes on error correcting codeSs and a recent system of Gol- 
dreich, Goldwasser. and Halevi /5/ which is based on the difficulty of lattice reduction 
problems. 

In this paper we describe a new public key cryptosystem, which we call the NTRU 
system. The encoding procedure uses a mixing system based on polynomial algebra and 
reduction modulo two numbers p and q, while the decoding procedure uses an unmixing 
system whose validity depends on elementary probability theory. The security of the 
NTRU public key cryptosystem comes firom the interaction of the polynomial mixing 
system with the independence of reduction modulo p and q. Security also relies on the 
(experimentally observed) fact that for most lattices, it is very difficult to find extremely 
short (as opposed to moderately short) vectors. 

We mention that the presentation in this paper differs firom an earlier, widely circu- 
lated but unpublished, preprint [7] in two major ways. First, we have introduced a new 
parameter K which can be used to produce systems with better operating characteris- 
tics. Second, the analysis of lattice-based attacks has been expanded and clarified, based 
largely on the numerous comments received fi*om Don Coppersmith, Johan Hast ad, and 
Adi Shamir in person, via email, and in the recent article [3]. We would like to take this 
opportunity to thank them for their interest and their help. 

NTRU fits into the general fi-amework of a probabilistic cryptosystem as described 
in [1] and [6]. This means that encryption includes a random element, so each message 
has many possible encryptions. Encoding and decoding with NTRU are extremely fast, 
and key creation is fast and easy. See Sections 4 and 5 for specifics, but we note here that 
NTRU takes 0 (N ^) operations to encode or decode a message block of length N, making 
it considerably faster than the 0 (N^) operations required by RSA. Further, NTRU key 
It gths are 0{N), which compares well with the O(N^) key lengths required by other 
"fast" public keys systems such as [9^ 5]. 

§1. Description of the NTRU algorithm 

§1.1. Notation. An NTRU cryptosystem depends on four integer parameters (N,K,p, q) 
and three sets ^gi ^ti>y 

c£ polynomials of degree N — 1 with integer coefficients. We 
work in the ring R = X[X]/{X^ — 1)- An element F E R wiU be written s a polynomial 
or a vector, 

i=l 

We write ® to denote multiplication in R. This star multiplication is given explicitly as 
a cyclic convolution product, 

k~l N 

F^G^H with Hfc = X)^«^fc-i"*"Z;^'^^+*^-^= ^^0' 

i— 1 j-=kr t+jsJb (mod N) 

When we do a multiplication modulo (say) we mean to reduce the coefficients modulo q. 

Remark. In principle, computation of a product F®G requires multiplications. How- 
ever, for a typical product used by NTRU, one of F or G has small coefficients, so the 
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computation of F ® G is very fast. On the other hand, if N is taken to be large, then it 
might be faster to use Fast Fourier Transforms to compute products F®G in O(NlogN) 
operations. 

§1.2 Key Creation. To create an NTRU key, Dan randomly chooses K 1 polynomials 
f^^i J ■ ■ ■ i9K € Cg. The polynomial f must satisfy the additional requirement that it have 
inverses modulo q and modulo p. For suitable parameter choices, this will be true for most 
choices of f , and the actual computation of these inverses is easy using a modification of 
the Euclidean algorithm. We will denote these inverses by Fq and i^p, that is, 

F,®/ = l(modg) and Fp ® / = 1 (mod /?). (1) 
Dan next computes the quantities 

/ii = F,®Pi (mod«), l<i<K. (2) 
Dan's public key is the list of polynomials 

{huh2,... ,hK)' 

Dan's private key is the single polynomial f, although in practice he will also want to 
store Fp. 

§1.3 Encoding. Suppose that Cathy (the encoder) wants to send a message to Dan (the 
decoder). She begins by selecting a message m from the set of plaintexts jC^n* Next she 
randomly chooses K polynomials 0i , . . . , </)fc G jCip and uses Dan's public key (/ii, . . . , hjc) 
to compute 

K 

e ~ ®hi + m (mod q). 

i=l 

This is the encoded message which Cathy transmits to Dan. 

§1-4 Decoding. Suppose that Dan has received the message e from Cathy and wants 
to decode it using his private key f . To do this efficiently, Dan should have precomputed 
the polynomial Fp described in Section 1.1. 
In order to decode e, Dan first computes 

a = f ® e (mod q), 

where he chooses the coefficients of a in the interval from —g/2 to q/2. Now treating a 
as a polynomial with integer coefficients, Dan recovers the message by computing 

Fp®a (mod p). 

Rernark. For appropriate parameter values, there is an extremely high probability that 
the decoding procedure wiU recover the original message. However, some parameter 
choices may cause occasional decoding failure, so one should probably include a few 
check bits in each message block. The usual cause of decoding failure will be that the 
message is improperly centered- In this case Dan will be able to recover the message by 
choosing the coefficients of a = / ® e (mod q) in a sliglitly different interval, for example 
from —q/2'^x to + x for some small (positive or negative) value of x. F no value 
of x works, then we say that we have gap failure and the message cannot be decoded as 
easily. For well-chosen parameter values, this will occur so rarely that it can be ignored 
in practice. 
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§1.5 Why Decoding Works. The polynomial a that Dan computes satisfies 
K 

a = f ® e = ^2 ^ ® P^i ® /li -H f ® m (mod q) 
K 

= 53/®P0t ® ®9i + / ®rn (modq) from (2), 
i=l 
K 

= ^p<^i(?>5i + /®m (mod^> from (1). 
i=l 

Consider this last polynomial 

K 
i=l 

For appropriate parameter choices, we can ensure that (almost always) all of its coefficients 
he between — <7/2 and so that it doesn't change if its coefficients are reduced modulo q. 
This meaas that when Dan reduces the coefficients of f ® e modulo q into the interval 
from — g/2 to q(/2, /re recovers exactly the polynomial 

K 

a = J2p<l)i®gi + f®m in Z[X]/(X^-l). 

i=i 

Reducing a modulo p then gives him the polynomial f ® m (mod p), and multiplication 
by Fp retrieves the message m (mod p). 

§2 Parameter Selection 
§2.1 Notation and a norm estimate. We define the width of an element i*" 6 R to be 

|F|„ = max {Fi} - min {Fj. 
i<»<W 1<«<JV 

As our notation suggests, this is a sort cf norm on R. Similarly, we define a centered 
norm on R by 

. N .1/2 ^ N 

\F\^ = [Y.^F,'^n - ^^^^ ^=ArE^^- 

(Equivalently, [i^lg /\/^V is the standard deviation of the coefficients of F.) 
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Proposition. For any 6 ^ 0 there are constants C\^C2 ^ 0, depending on e. N and K, 
such that for randomly chosen polynomials . . . ,FKtG\^. .. jCk ^ the probability 
is greater than 1 — £ that they satisfy 



(3) 



Of course, this proposition would be useless from a practical veiwpoint if the ratio 
0-2 /c\ were very large for small e's. However, it turns out that even for moderately large 
values of N and K and very small values of e, the constants Cx, C2 are not at all extreme. 
We have verified this experimentally in a large number of situations and have an outline 
of a theoretical proof. 

§2.2 Sample spaces. As examples cf typical sample spaces, we will take 

Cg = {g E R : g has coefficients between — (f — l)/2 and (f — l)/2 inclusive) 
= {(f) E R : (/> has d coefiicients equal 1, d coefficients equal —1, the rest 0} 
= {tt^ G R : m has coefficients between — — l)/2 and (s— l)/2 inclusive) 

Later we will see that there are various constraints which T^d,s must satisfy in order 
to achieve security. We also note that every (p € has L norm I0I2 = \/2rf, while 
average elements g E and m G jCm have norms |ffl2 — \/N(r^ — 1)/12 and iTTilg = 
y/N{s^ — 1)/12 respectively. To ease notation, we will write Lg^L^^Lm for the average 
norm cf elements cf C^yCfftjCm respectively. 

Although it is not strictly necessary, we will make the additional assumption that 
^ P^4> This assumption will make it easier to analyze possible lattice attacks, as well 
as making such attacks less effective. As an example, suppose we take d f« JV/4. Then 
we would take s ^ >/6p. So the natural mod p information contained in m would have to 
be "thickened" by randomly adding and subtracting p to coefficients cf m. 

§2.3 A decoding criterion. As described in $1.5, Dan will be able to decode the en- 
coded message m provided that Ep^i @ffi^"f@iTi|oo ""^l- ^® the inequality (3) 
cf the above Proposition (with K* \ m. pla 
to estimate 



>lace cf K and for a suitably small choice of e) 



K I K 

YlP^<®3i + f®^\ <C2 Y^P\^i\2 • \9i\2 + I/I2 • M2 
1=1 loo i=I 

r; C2Lg{KpL^ + Lm) 

^ C2pLgL^{K + 1 ) using the assumption Lm ^ pL^ 

So in order to decode (with probability l — E), Dan needs to choose parameters satisfying 
the decoding constraint 

C2pLgL^{K+l) <q, (4) 
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§3 Security Analysis 

§3.1 Meet-in- the-middle attacks. For simplicity (and to aid the attacker), we assume 
K = 1, so an encoded message looks like e = <^ ® h m (mod g). Andrew Odlyzko has 
pointed out that there is a meet-in- the- middle attack which can be used against 0, and 
we observe that a similar attack applies also to the private key f . Briefly, one splits f in 
half, say f = /i /2, and then one matches /i ® e against — /2 ® looking for {fi^fz) so 
that the corresponding coefficients have approximately the same value. Hence in order 
to obtain a security level of (say) 2***, one must choose f , ff, and ((> from sets containing 
around 2^^^ elements. 

§3.2 Multiple transmission attacks. Again for sinqjUcity we assume that K = 1. We 
observe that if Cathy sends a single message m several times using the same pubhc key 
but different random <^'s. then the attacker Betty wiU be able to recover a large part of the 
message. Briefly, suppose that Cathy transmits = 0t@/iH-m (mod q) fori = 1,2,... ,r. 
Betty can then compute (e, — f i) (g) h^^ (mod q), thereby recovering <f>i — (pi (mod q). 
However, the coefficients of the (^'s are so small that she recovers exactly (pi — (pi, and 
from this she will recover exactly many of the coefficients of <j^i. If r is even of moderate 
size (say 4 or 5). Betty will recover enough of (pi to be able to test all possibilities by 
brute force,thereby recovering m. Thus multiple transmission are not advised without 
some further scrambling of the underlying message. We do point out that even if Betty 
decodes a single message in this fashion, this information wiU not assist her in decoding 
any further messages. 

§3.3 Lattice based attacks. 

We begin with a few words conceming lattice reduction. The goal of lattice reduction 
is to find one or more "small" vectors in a given lattice M. In theory, the smallest 
vector in M can be found by an exhaustive search, but in practice this is not possible 
if the dimension of M is large. The LLL algorithm of Lenstra-Lenstra-Lovasz [8], with 
various improvements due to Schnorr [11, 12) and others, wiU find small vectors of M in 
polynomial time, but for most lattices of large ( > 100, say) dimension, it will not find 
the smallest vector, and the gap between the smallest LLL-determinable vector and the 
actual smallest vector appears to increase exponentially with the dimension. In order 
to describe the security of NTRU from lattice attacks, we consider the following three 
hypotheses on lattices cf large dimension: 

(Hi) For most lattices M, the length ct(A^) of the smallest non-zero vector cf M 

satisfies 

Hence if v ^ M satisfies 

|v| > ,S^Disc(A<)i/<*'"(^>, 

V TTC 

then V will be hidden in a cloud cf exponentially many vectors of approximately 

the same length. 
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(H2) Suppose that the lattice M has a vector w which is smaller than the shortest 
expected vector described by (Hi), but that M is otherwise a "random" lattice. 
If w satisfies 

V ne 

then lattice reduction is highly unlikely to find w. 
(H3) Suppose are in the situation of Then the smallest non-zero vector 

Ylll computed by lattice reduction methods is almost certain to satisfy 

Remark. The lattice reduction constant k which appears in hypotheses (H2) and (H3) 
must be determined by experimentation and experience. This is similar to the situation 
with the RSA PKCS, where security rests on estimating current capabilities for factoring 
products pq. It is even more closely analogous to the PKCS described in [5], whose 
security is directly linked to the difficulty of finding small (almost orthogonalizcd) bases for 
lattices. Experiments with lattices of large ( > 100) dimension suggest that one can take 
= 1.5^/^^. (See, for example, [11] and [12].) And just as future advances in factorization 
will require the use cf larger primes in the RSA PKCS, so fiiture advances in lattice 
reduction will undoubtedly require using a smaller value cf ft and correspondingly larger 
parameters in NTRU. We also mention that \w will only need to assume hypotheses (H2) 
and (H3 ) for lattices of dimension greater than 700. For lattices of such high dimension, 
even the LLL algorithm with Schiiorr*s block reduction improvement takes quite a long 
time. If we are willing to assume hypotheses (H2) and (H3) for lattices of dimension 
around 300, we can choose NTRU parameters with even better operating characteristics. 

§3.3.1 Small lattice attack on the key f . We begin with what is probably the most 
natural lattice, namely we take any one of the /i^'s and search for the small vector f with 
the property that /ij ® / (mod q) is also small. To do this, we write hi = [hn,, . . ,/iiA/] 
and consider the lattice M generated by the columns of the following matrix: 



M = 



/ 


A 


0 


0 


0 


0 


0 \ 




0 


A 


0 


0 


0 


0 




0 


0 


A 


0 


0 


0 




hn 


hi2 






0 


0 




hi2 




ha 


0 




0 


\ 








0 


0 


9 



With an eye towards fiiture notational convenience, we will write this matrix as 
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The quantity A will be cilosen by the attacker to optimize the attack. We observe that 
satisfies 

dim(M) = 2N and Disc{M) = A^q^. 

There are two issues to consider. First, is the actual key f embedded in M as a short 
vector. Notice that At contains the target vector 

^targ = [A/jV, . . . , A/i,pii, . . . , QiN], 
and knowledge of Vtarg allows recovery of f . However, we can compute the length of Vtarg 



Hypothesis (Hi) says that f is safe from attack if |utargl2 satisfies the inequality 

V ire V 7re 

In other words, we need 

V 7re 

The optimal A from the attacker's viewpoint is A = 1 (see Lemma A,l), since she wants 
to minimize the left-hand side. So we will be safe provided 



N 



(5) 



A second consideration is whether some other small vector in might allow the 
attacker to decode the message. Thus any small vector € M has the property 

that f* and hi($> f = g' (mod q) arc both small. However, if the attacker computes 

K 

e(g>f = ® /ij ® f +m<g>f' (modg), 

only the term with j = i will have small coefficients modulo q. Hence an /' which makes 
a single /i, small will not act as a decoding key. This suggests that we look at all of 

the hj'& simultaneously, which leads us to the next lattice. 

§3.3.2 Big lattice attack on the key f. Rather than using only one of the /i^'s, the 
attacker can instead form a lattice using some subset of the hiS. Relabeling, we will 
assume that the attacker uses h\,. . . ,hk for some 1 < /c < K and forms the lattice M 
generated by the columns of the matrix 

^ A/ 0 0 0 0 

hi ql 0 0 ••• 0 

h2 Q ql 0 0 

0 0 ql 0 



V/tic 0 0 0 
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(We are using the abbreviated notation from the previous section.) This lattice satisfies 

dim(A^) = (k + 1)N and Disc(A^) = A^q*^. 
It contains the target vector (using the obvious shorthand) 

VtKTg = [A/, 91,92,"' , 9k\' 
(More precisely, the coordinates cf / need to be reversed.) This target vector has length 



Hypothesis (Hj) savs that lattice reduction will not be able to find "Utarg provided that 
its length satisfies 



V Tre 



So will be safe from attack if 



^ V Tre 

As before, the attacker will choose A to minirnize the left-hand side. Again it turns 
out that A = 1 gives the niiaimum (See Lemma A.l)j so the actual key wiQ be safe under 
Hypothesis (Ha) provided 



(6) 



§3.3.3 Big lattice attack on a spurious key f . Rather than searching for the true 
key /, the attacker might try to find some other key F which acts as a decoding key. In 
order to be a spurious key, F itself and also each of the products hj ® F (mod q) must 
be small. More precisely, suppose that the attacker finds an F and computes 

G^=hjmF imodq) for j = 1,2,... 

We would like to know that the width {L°^ norm) cf an expression 

^1 ® C?i + <?^2 ® ^^2 + + 0if ® m ® F 

is generally at least Wq for some wrapping factor W. (We wiU discuss in Section 4 the 
question of how large W must be for for the system to be secure.) 
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In order to try to find a spurious key F, the attacker will take the lattice M described 
in Section 3.3.2 and use lattice reduction techniques to find a small vector v^LL^ The 
smallest non-zero vector in /A is the vector tJtarg ~ [Af,5i,. . . i9K]t so Hypothesis (H3) 
says that 

|vz,i,i|2>l.('^+*>'^|«t„g|^. 

Writing Viii, = [AF,Gi,C?2,. . . ,Gk], vie find that 

^A2|F|i + |Gi|i + ... + |G^|2 > K('f+l)'^Lg^/A^TT. 

The vector v^/,/, obtained by lattice reduction will have components whose size is more- 
or-less randomly distributed. In particular, all of the lengths lAi^'lj , l^ilg , ■ ■ ■ > |G^K"l2 will 
be approximately the same, so we obtain (approximately) 

|AF|j,|Gi|j,...,|GK|2>K<'^+i>^Lg. 

On the other hand: wc can use this aiid (3) to estimate 

® + <?!>2 ® ^2 H \-<Pk ®Ok -^rn® 

> ci(|0i|2 • \G^\^ + - - • + \M2 ■ \Gk\2 H- • \F\^) 
= ciZ.^(|Gi|2+..- + |GKl2 + |i^l2) 

So the spurious key will fail with wrapping factor W provided the parameters are chosen 
to satisfy 

Wq < ci(K + l)L^LgK<^+'^^^, (7) 
(This may be compared with the decoding inequality (4),) 

§3.3.4 Big lattice attack on an individual message. There is one other sort of 
lattice attack which must be considered. Rather than looking for a key which decodes 
every message, an attacker can construct a lattice to search for an individual message. 
Consider the following lattice, which is similar to the one used in Section 3.3.2. Let M 
be the lattice generated by the columns of the matrix 



/XI 


0 


0 


0 - 


0 




0 


XI 


0 


0 - 


0 


0 


0 


0 


XI 


0 • 


0 


0 


0 


0 


0 


XI ' 


0 


0 




ph2 
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This lattice satisfies 

diin(A4) = (K+1)N and Disc(A^) = A^^q^ 

and contains (using the obvious notation) the vector 

lX<f>i , A(^2, . . . , X</>K^ e-m]. (8) 

It contains this vector because the encoded message e was constructed according to the 
rule 

p<pi ® hi p^2 ® h2 ~\ h p4)k ® m = e (modq). 

Clearly (8) is not likely to be a short vector, since the coefficients of e — m (mod q) 
will not be small. However, the attacker knows the value of e, so she can search for a 
vector in A4 which is close to the known non-lattice vector [0,0,.. . ,0,e]. The distance 
firom the sought for lattice vector and the known non-lattice vector is the length of the 
vector 

Utarg — [A^1,A^2^.■. )A^/C,-m]. 

This is an example of an inliomogeneous lattice problem. Inhomogeneous problems tend 
to be somewhat harder than homogeneous problems, but to err on the side of caution, 
we will assume that the attacker can solve inhomogeneous problems to the exact same 
degree she can solve homogeneous problems. So we need to see if the attacker can find a 
vector of length 

(Remember that \m\2 = for every m E Cm and every <f> E jC^.) According to 

Hypothesis (H2), the attack will fail provided that 



or in other words, if 



V TTC 

The attacker will minimize the left-hand side by taking A = p (see Lemma A.l), so the 
attack will fail provided 

^l/iK^DK^iK+DN^ /![£„l/(K+l). (9) 
This may be compared with (6), which it complements. 
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§3.3.5 Summary of lattice attack parameter constraints. In the preceding parts 
of this section we have described various lattice attacks and devised constraints on the 
parameters which prevent these attacks from succeeding. There remains the question of 
whether there exist any choices of parameters which satisfy all of the constraints. For the 
convenience of the reader, we list here all c£ the inequalities fi"om this section, together 
with the fundamental inequality (4) which is necessary if the owner of the true key f is 
to be able to decode messages. 

C2pLgL4,{K^l)<q, (4) 

TreLl 



S ^(fc+i)iVi^y^ fo, every 1 < < 



(6fc 



H'g<c,(A- + l)L^L,«(«'+»>'' (7) 



(9) 



We observe that for any fixed values Ci ^ C2, p, > 0 and p, W > 1 , there always exist 
solutions N, K, Lg^ q to these inequalities. We now make a few remarks to assist in finding 
solutions. 

We begin by combining these inequalities in various ways. First combining (4) and (7) 
gives (after some algebra) 

logK 

Note we have (essentially) no freedom in choosing Ci , C2, and ac, and that W will be chosen 
between 5 and 10 depending on the level of security desired. This leaves the choice of p, 
which will normally be fairly small. The point here is that (10) gives a lower bound for 
(K+1)N over which we have very little control. 
Next we combine (4) and (5) to get 

In order to have some flexibility in the choice of q, it is a good idea to take Lg to be 
(say) 1.5 to 2 times larger than this prescribed lower bound. 

For example, if £^ and Cg are as described in Section 2.2, then = y/2d and most 
g e Cg satisfy \g\2 ^ Lg = y/N{r^ - 1)/12. So after using (11) to choose Lg^ we 

can take r = \^Lgy/l2/N \y and then most g G Cg will have norm very close to the 
desired Lg. Further, since the code creator Dan is the only one who chooses elements 
from Cg^ and since these choices only need to be made once, it won't be hard for him to 
find the necessary K "I" 1 polynomials in Cg with norm approximately Lg; and even with 
the length restriction, the number of such polynomials in Cg is astronomically larger than 
an attacker can check via exhaustive search, since in practice tends to be at least 2^^°. 
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§4 Implementation Considerations 

§4.1 Security and Wrapping Factors. Recall that the wrapping factor W controls 
how much wrapping the attacker can expect when she uses a spurious key produced by 
lattice reduction. If W is too small, for example W = 1.5, then the attacker will be able 
to recover many (maybe even most) cf the coefficients, because their values tend to cluster 

around the mean. More precisely, the attacker will recover (say) 0.95A'' linear equations 
for the N imkown coefficients, and then a brute -force search finishes the attack. 

Coppersmith and Shamir [3] have observed that even if W is a bit larger than this^ 
say W = 2.5, then the clustering allows the attacker to obtain approximately 
linear equations for the N unknowns. They then observe that if the attacker constructs 
two independent spurious keys and applies them, she might obtain sufficiently many 
independent equations to solve the system. They further note that if W = 4, then using 
several short vectors mi^ib allow the attack to succeed by employing some sort of error- 
correcting technique, but that if W is as large as 10, then this sort of attack will not 
succeed. We refer the reader to [3] for details. 

Based on these considerations, we will use a wrapping factor of W = 10 to construct 
sample operating parameters. 

§4.2 Sample Operating Parameters. In this section we will work out two sets of us- 
able parameters for the NTRU PKCS which are secure under the hypotheses of Section 3. 
These parameter sets lead to a fairly high message expansion, so we refer the reader to 
Section 4.3 below for a two-stage version of NTRU which reduces the message expansion 
to a managable 2-to-l. 

We begin with three values forced on us by experimental evidence, and a fourth value 
chosen to ensure sufficient wrapping to foil a spurious key attack: 

ci = 0.08, C2 = 0.24, = 10 K = 1.5^/^°** ^ 1.0040628823. 

The vaiues of Cj and ca have been determined by extensive numerical testing in the desired 
ranges: but we also have a fairly good idea how to give them a probabilistic justification. 
The wrapping factor W = 10 was discussed above in Section 4.1. Finally, the choice of 
the lattice reduction constant k has already been discussed in the remark in Section 3.3, 
although to guard against future improvements in lattice reduction technology, the se- 
curity conscious user might instead take k = 1.3^/-^^°, with minor changes in the other 
parameters. 

We consider first the choice p = 2. The inequality (10) fi"om Section 3.3.5 tells us that 
we need to take 

(K+ 1)N> 1009.79, 

so we wiU let 

iV = 167 and K = 6. 

(It is convenient, but not necessary, to have N and (N — l)/2 both prime.) This choice 
will provide sufficient leeway for choosing the remaining coefficients. 

We take £^ as in Section 2.2 with d = 20, so if^C^ = 167!/20! ■ 20! . 127! ftJ 2^^^'^^, 
which provides sufficient security against meet-in-the-middle attacks. Further, = 
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\/2d ~ 6.325, and substituting these choices into (11) gives Lg > 414.07. To provide 
some leeway, we take r = 167, which makes the expected value g£ Lg equal to 622.98. 
Finally, our five fundamental inequalities from Section 3.3.5 tell us that q must satisfy 

213.6924 ^ ^ < rnax{2^^'2766 214-7278 214.6238 252.481 J 

(Of course, the inequality (6fe) in Section 3.3.5 is really 6 inequalities, one for each 1 < 
fc < 6.) Thus we can take q = 2^* — 1 = 16383. (Note that gcd(p^ q) = 1 is required.) 
To recapitulate, assuming the hypotheses of Section 3.3, the following parameters give a 
secure NTRU PKCS: 

iV = 167, k=^6, (?= 16383 = 2^'* - 1, p = 2, r = 167, d = 20, s = 3, 

where the sets Ctf^^CgfCm are chosen as described in Section 2.2. For these parameters 
we have 

Public key length = Nk logg q = 14028 bits 

Private key length = N log2 pr = 1400 bits 

Message expansion = log q^/ log p = 14-to-l 

Using a similar analysis, we construct a second set of secure NTRU parameters with a 
larger value of p. These parameters seem well suited to current microprocessors, since all 
operations are on numbers smaller than 2^^, and q is a power of 2, so division by q with 
remainder is a simple shift operation. We take 

N = 167, K = 6, q = 2^^, p = 3, r = 354, d = 40, s = 7. 

These parameters give = 1671/40! ■ 40! . 87! 2^^^-^, and 

Public key length = NKloggq = 16032 bits 
Private key length = N log^pr = 1678 bits 
Message expansion = logq/ logp = 10.1-to-l 

§4.3 Two-Stage NTRU and Improved Message Expansion. The NTRU PKCS*s 

for the sample parameters presented in Section 4.2 have rather large message expansions. 
One method to decrease this expansion is to use a larger value of p, but this leads 
to significantly larger values for (K 1)^^, which in turn increases both key sizes and 
decreases computational efficiency. 

Another method to decrease message expansion is to use each NTRU message as a 
sort of one-time-pad to encode the actual message. In this two-stage version of NTRU, 
the encoder Cathy chooses a random polynomial while her actual plaintext 

message M is allowed to be any polynomial modulo q. To encode her message, she 
computes the two quantities 

K 

e = ^p^i ® /li + m (modq) and E = m®hi-\- M (mod q). 



SUBSTtTUTE SHEET (RULE 26) 



wo 98^8323 



43 



PCT/US97/1S826 



The encoded message is the pair (e,E). 

The decoding process is similar to before, but with one extra step. Thus the decoder 
Dan follows the procedure described in Section 1.4 to compute the polynomial m. He 
then recovers the message by computing 

E — m® hi (mod q). 

We observe that the plaintext message M has length I062 ^ bits, while the encoded 
message (e,E) has length 2N\og^ q bits, so message expansion is down to 2-to-l. 

We make one further remark. Cathy is using the same polynomial and modulus to 
encode both m and M. We do not believe that this compromises security, but for added 
security she could compute E = m®H^"M (mod Q) for a different (public) polynomial H 
and modulus Q. 

§4.4 Theoretical Operating Specifications. In this section we consider the theo- 
retical operating characteristics of the NTRU PKCS. There are four integer parame- 
ters (N,K,p,q), three sets Lg^C^^C^a determined respectively by integers r. d,s as de- 
scribed in Section 2.2, three experimentally determined constants jC2t and a wrapping 
constant W. To ensure security, these parameters must be chosen to satisfy the inequal- 
ities listed in Section 3.3.5. The following table summarizes the NTRU PKCS operating 
characteristics in terms cf these parameters. 



Plain Text Block 


N logj^ p bits 


Encoded Text Block 


N log, q bits 


Encoding Speed* 


O(KN^) operations 


Decoding Speed 


O(N^) operations 


Message Expansion 


logp q-to-1 


Private Key Length 


N log, pr bits 


Public Key Length 


KNlog, q bits 



* Precisely, AKN^ additions and KN divisions by q witli remainder 

For Two-Stage NTRU as described in Section 4.4, the following items change: 



Plain Text Block 


Nlog, q bits 


Encoded Text Block 


2Nlog2q bits 


Message Expansion 


2-to-l 



$4.5 Other Implementation Considerations. We briefly mention some additional 

factors which should be considered when implementing NTRU. 

(1) It is important that gcd(qf,p) = 1. Although in principle NTRU will work without 
this requirement, in practice having gcd(q, p) 1 wiU decrease security. At the ex- 
treme range, if then (exercise) the encoded message e satisfies e = ?n (modp), 
so it is completely insecure. 
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(2) We want most /'s to have inverses modulo p and modulo q. since otherwise it will 
be hard to create keys. A first necessary requirement is that gcd(/(l),pg) = 1, 
but if this fails for some chosen f , the code creator can instead use, say, f (X)+ 1 
or f (X)— 1. Assuming gcd(f (l),pq) = 1, virtually all f's will have the required 
inverses if we take N to be a prime and require that for each prime P dividing p 
and q, the order of P in {Z/NZ)* is large, say either N - 1 or (N - l)/2- For 
example, this will certainly be true if (N— l)/2 is itself prime (i.e., N is a Sophie 
Germain prime). Examples of such primes include 107 and 167. 

§5 Moderate Security Parameters For NTRU 

There are many situations in the real world where high speed and/or low memory 
requirements are important and a moderate level of security is acceptable. In this context, 
we observe that actual lattice reduction methods [11, 12] are extremely CPU intensive 
and that, in practice, it requires a large expenditure of computer time to perform a lattice 
reduction on a lattice cf dimension 200 to 300. Of course, "large" here is a relative term, 
but it would probably not be worthwhile to perform a 300 dimensional lattice reduction 
to steal something worth a fraction of a cent, and it would certainly be very expensive (if 
not completely infeasible) using current methods to perform such a lattice reduction in a 
short period of time (say a few minutes). Thus it is worthwhile creating a set of NTRU 
parameters which can be used in situations where one is willing to allow the possibility 
of large dimensional lattice attacks. 

ff we eliminate the parameter constraints coming Ixom lattice attacks, we are left with 
only the decoding constraint 

C2pLgL4K + l)<q (4) 

and the condition that the search spaces for f , g, and 4 are large enough to prevent a 
brute-force (or possibly a meet-in-the-middle) attack. For simplicity, we will take K = 1. 
We will take all of S^g^4> to be in the set Z^-^, which is the set of polynomials with d 
coefficients equal to 1, d coefficients equal to —1, and the other N — 2d coefficients equal 
to 0. (More precisely, since we need f to be invertible modulo p and q, we wiU take f to 
have an extra 1 coefficient, but this will have little effect on the subsequent analysis, so 
we will ignore it.) Using C2 = 0.24 as usual, the decoding constraint becomes simply 



g > 2pd. (4) 

Our other constraint is 



(d; d\ N -2d) (dl)2(iV - 2d)\ " ' 

where a is the desired security level. We note that for moderate security implementations, 
a security level of around 2^^ will generally suffice, so we will take a ~ 40. 

The following table gives some acceptable operating parameters for a moderate security 
implementation of NTRU. In evaluating the security, we note that available lattice attacks 
use a lattice of dimension 2N. We also note that the listed value of q is the smallest 
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allowed, but that a somewhat larger q satisfying gcd(p, q) = 1 is acceptable. In particular, 
especially fast implementations are available by taking q = 64. 



N 


d 








107 


9 


41.11 


2 


37 


107 


9 


4L11 


3 


55 


167 


7 


38.98 


2 


29 


167 


7 


38.98 


3 


43 


263 


7 


43.72 


2 


29 


263 


7 


43.72 


3 


43 



Finally, we observe that the key sizes are very small. 

Public Key: N log, (q) bits 
Private Key: 2N logj (p) bits 

For example, (N,d,p, q) = (167, 7,3,64) gives a system with public and private keys of 
lengths 1002 bits and 530 bits respectively. 

§6 Comparison With Other PKCS's 

There are currently a number of public key crypto systems in the literature, including 
the system of Rivest, Shamir, and Adelman (RSA [10]) based on the difficulty of factoring, 
the system of McEliece [9] based on error correcting codes, and the recent system of 
Goldreich, Goldwasser, and Halevi (GGH [5]) based on the difficulty of finding short 
almost-orthogonalized bases in a lattice. 

The NTRU system has some features in common with McEliece^s system, in that @- 
multiplication in the ring R can be formulated as multiplication of matrices (of a special 
kind), and then encoding in both systems can be written as a matrix multiplication 
E = AX Y. where A is the public key. A minor difference between the two systems 
is that for an NTRU encoding, Y is the message and X is a random vector, while the 
McEliece system reverses these assignments. But the real difference is the underlying 
trap-door which allows decoding. For the McEliece system, the matrix A is associated to 
an error correcting (Goppa) code, and decoding works because the random contribution 
is small enough to be "corrected" by the Goppa code. For NTRU, the matrix ^ is a 
circulant matrix, and decoding depends on the decomposition of A into a product of two 
matrices having a special form, together with a lifting from mod q to mod p. 

As far as we can tell, the NTRU system has little in common with the RSA system. 
Similarly, although the NTRU system must be set up to prevent lattice reduction attacks, 
its underlying decoding method is very different firom the GGH system, in which decoding 
is based on knowledge of short lattice bases. In this aspect, GGH actually resembles the 
McEliece system, since in both cases decoding is performed by recognizing and eliminating 
a small random contribution. Contrasting this, NTRU ehminates a much larger random 
contribution via divisibihty (i.e., congruence) considerations. 
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The following table compares some of the theoretical operating characteristics of the 
RSA, McEliece, GGH, and NTRU cryptosystems. In each case the number N represents 
a natural security /message length parameter. 





NTRU 


RSA 


McEliece 


GGH 


Encoding Speed 








N' 


Decoding Speed 






JSf2 




Pubhc Key 


N 


N 


]Sf2 


JSf2 


Private Key 


N 


N 




N' 


Message Expansion 


2-1 


1-1 


2-1 


1-1 
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Appendix A. An Elementary Lemma 

The following result is useful for optimizing lattice attacks. 
Lemma A.l. For all A,B,a,j3 > 0 with a + /3 = 1, 

inf Ax" + Bx-^ = 

with the infimum occurring at x = fiB/aA. 

Proof Letffxj = Ax"" Bx~ . Then f'fxj = aAx""^ - l3Bx-^~^ = x^+^{aAx - /SB). 
So the absolute minimum is at x = PB/aA. (Note that /(x) — *^ oo as x — »■ 0"^ and as 
X -* oo.) 
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CLAIMS : 

1. A method for encoding and decoding a digital message 
m, comprising the steps of: 

selecting ideals p and q of a ring R ; 

generating elements £ and g of the ring R, and 
generating element which is an inverse of f (mod q) / and 
generating element Fp which is an inverse of f (mod p) ; 

producing a public key that includes h, where h is 
congruent, mod q, to a product that can be derived using g and 

producing a private key from which f and Fp can be 

derived; 

producing an encoded message e by encoding the 
message m using the public key and a random element o and 

producing a decoded message by decoding the encoded 
message e using the private key. 

2. The method as defined by claim 1, wherein said ring 
R is a module over a ring Z. 

3 . The method as defined by claim 1 , wherein the 
dimension of R over Z is N, and where N is an integer greater 
than 1 . 

4 . The method as defined by claim 3 , wherein the ring R 
is a ring of polynomials modulo a particular polynomial . 
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5. The method as defined by claim i, wherein said step 
of generating elements further comprises generating element 
which is an inverse of g (mod q) , and generating element Gp 
which is an inverse of g (mod p) . 

6. The method as defined by claim 5, wherein said 
element Gq is used in the derivation of said public key and 
said element Gp is part of said private key. 

7. The method as defined by claim 1, wherein said 
selecting step further includes selecting a positive integer 
K, and wherein said element g comprises respective g, , with i = 
1;2,...,K, and wherein said public key, h, comprises 
respective h, , with i = 1,2, ...,K. 

8 . The method as defined by claim 7 , wherein said 
random element 0 comprises respective 0^ in the ideal p , with i 
= 1,2, ... ,K, and wherein said encoded message is produced as 

K 




9 . 



The method as defined by claim 1 , wherein said 



public and private keys each further include p and q. 
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10 . The method as defined by claim 1 , wherein said 
ideals p and q are generated by relatively prime integers . 

11. The method as defined by claim 10, wherein the 
encoded message is congruent, mod q, to the sum of the message 
m and a product that includes o and h. 

12. The method as defined by claim 10, wherein said 
integers p and q are unequal and both p and q are greater than 
1. 

13. The method as defined by claim 1, wherein said 
encoded message is produced by a user at one location, 
transmitted from said one location to another location, and 
decoded by a user at said another location. 

14 . A method for encoding and decoding a digital message 
m, comprising the steps of: 

selecting integers p and q; 
generating polynomials t and g; 
determining inverses and , where 

Fq*f s 1 (mod q) 

Fp*f s 1 (mod p) ; 
producing a public key that includes p , q , h , where 

h s Fq*g (mod q) ; 
producing a private key that includes f and Fp; 
producing an encoded message e by encoding the 
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message m using the private key and a random element o 7 and 

producing a decoded message k^y decoding the encoded 
message e using the private key. 



15. The method as defined by claim 14, wherein said 
encoded message e is produced as 

e s p0*h+ni (mod q) . 



16. The method as defined by claim 15, wherein said 
decoded message is produced by computing 

a = f *e (mod q) , 
and then computing the decoded message, m' , as 

ra' s Fp*a (mod p) . 

17. The method as defined by claim 14, wherein said step 
of generating polynomials f and g includes selecting a 
positive integer K and generating K polynomials g, as g, , 

9/ / ■ ■ ■ /Sk* sind wherein said public key comprises h^, h, , . . . ,hK, 
where 

hi = Fq*gi (mod q) , i = 1,2, . . . ,K. 

18. The method as defined by claim 17, wherein said 
encoded message e is produced as 

e s p0i*hi+p02*h2+- . . +p0K*hK+^ (mod q) 
where 0^,02' - - - '^k ^ random polynomials. 



19. The method as defined by claim 14, wherein said 
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encoded message is produced by a user at one location, 
transmitted from said one location to another location, and 
decoded by a user at said another location. 

20, The method as defined by claim 14, wherein a raonic 
polynomial M(X) is selected and multiplication of polynomials 
is accomplished by first performing ordinary multiplication of 
polynomials and then dividing the result by M(X) and retaining 
only the remainder. 

21. The method as defined by claim 14, wherein a non- 
zero integer N is selected and multiplication of polynomials 
is accomplished by reducing exponents modulo N. 

22 . The method as defined by claim 14 , wherein said 
polynomials f, g, m and o are constrained to have bounded 
coefficients . 

'23. The method as defined by claim 22, wherein said 
integer q is chosen smaller than a quantity determined by the 
said integer p, the degrees of the said polynomials f , g, m 
and o, and the said constraints on the coefficients of the 
said I , g , m and o . 

24. The method as defined by claim 22, wherein said 
integer q is chosen larger than a quantity deteirmined by the 
said integer p, the degrees of the said polynomials f , g, m 
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and o , and the said constraints on the coefficients of the 
said polynomials g , m and o. ^ 

2 5. A method for encoding and decoding a digital 
message, comprising the steps of: 

selecting relatively prime integers p and q; 
selecting a non-zero integer K; 

producing K+2 matrices, f ,g ,vi^,w„ ...,Wj^ from a ring 
of matrices with integer coefficients, with s 0 (mod p) for 
i = 1,2, ... ,K. 

producing inverse matrices Fp, Fg, Gp and G„ from 
said ring of matrices where 

fPp a I (mod p> 
fPq = I (mod q) 
gGp m I (mod p) 
gGq = I (mod q) 
where I is an identity matrix; 

producing a public key as a list of K matrices 
(hijhj, . . .h,;) where 

h, s FqWiGq (mod q) , i = 1 , 2 , . . . ,K; 
producing a private key as the matrices (f , g, Fp, 

producing an encoded message e by encoding the 
message m using the private key and random integers 
0^ , 02 , . . . , 0K as 

e = 0ihj +021^2 "•" • ■ • +0KhK+nn (mod q) ; and 
producing a decoded message m' by computing 
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a = feg (mod q) 
and 

b = a (mod p) 
and then computing the decoded message m' as 

m' = FpbGp (mod p) . 

26. The method as defined by claim 25, wherein said 
encoded message is produced by a user at one location, 
transmitted from said one location to another location, and 
decoded by a user at said another location. 

27. The method as defined by claim 25, wherein said 
matrices w, , . . . , w,, f, g, and m are constrained to have 
bounded coefficients and the integers 0^,02, ... ,0k' sire 
constrained to be bounded. 

28. The method as defined by claim 27, wherein said 
integer q is chosen smaller than a quantity determined by said 
integer p, said integer K, the degrees of said polynomials 
WjjWg, . . .,Wk, t, g, and m, said constraints on the coefficients 
of said polynomials w^^Wj, . . . ,Wj^, f , g, and m, and said 
constraints on the integers 0i,02' - ■ -/^k' 

29. The method as defined by claim 27, wherein said 
integer q is chosen larger than a quantity determined by said 
integer p, said integer K, the degrees of said polynomials 
Wi,Wj, . . . ,Wk, f, g, and m, said constraints on the coefficients 
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of said polynomials , w, , . . . , w^, f, g, and m, and said 
constraints on the integers 01,02* - ■ ■ /®k- 

30. A system for encoding and decoding a digital 
message m, comprising: 

means for selecting ideals p and q; 

means for generating elements f and g of a ring 
and generating element which is an inverse of f (mod q) , and 
generating element Fp which is an inverse of f (mod p) ; 

means for producing a public key that includes h, 
where h is congruent , mod q, to a product that can be derived 
using g and F,; 

means for producing a private key from which f and Pp 
can be derived; 

means for producing an encoded message e by encoding 
the message m using the public key and a random element o ; and 

means for producing a decoded message by decoding 
the encoded message e using the private key. 

31. The system as defined by claim 30, wherein said 
encoded message is produced by a user at one location, 
transmitted from said one location to another location, and 
decoded by a user at said another location. 

32 . A method of communicating information between users 
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of a communications system, the method comprising the steps 
of: 

generating a ring R, ideals P and Q in R, a set of 
coset representatives Cg for the ring R modulo the ideal Q , and 
a set of coset representative Cp for the ring R modulo the 
ideal P ; 

generating at least one public key element h, . . ,h,^ 
in the ring R as a function of at least two private key 
elements /i / . . ./n R and the ideal Q of the first user; and 

transmitting from a first user to a second user a 
description of the ring R, the ideal Q, the ideal P, and the 
elements h^, . . . ,h|j in Re- 
generating an element e in R as a function of the 
ideals P and Q, the public key elements h, . . /h,, a private 
message element m in R, and at least one private random 
element a^, . . . ,o, of the second user; and 

transmitting the element e from the second user to 
the first user, such that the first user can determine the 
message element iti by computing the result A in R of evaluating 
the function F of e,/j,...,/n, computing the coset 
representative a of A in the set of coset representatives Cq, 
computing the result B of evaluating the function G of 

^tf\t . . .tfnt computing the coset representative b of B in the 
set of coset representatives C, , and computing the result c in 
the set of coset representatives Cp of evaluating the function 
H of b,/, /„. 
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33. The method of claim 32, wherein the message element 
m satisfies the condition that m is an element of C, . 

34. The method of claim 32, wherein the first user 
deteirmines the message element m by computing a function of 
a,b, c,/i, . . . ,/„. 

35. The method of claim 32, wherein the public key- 
elements h, . . ,hi, satisfy the condition that the element is 
congruent in R to the product h^/js^j modulo the ideal Q for each 
i between 1 and k. 

36. The method of claim 32, wherein the private key 
elements f^, ■ . . i /i^i satisfy the condition that the elements 
/i,...,/^ are in the ideal P. 

37. The method of claim 32, wherein the private random 
elements Oj, . . .0, are in the ideal P. 

38. The method of claim 32, wherein the element e 
generated as a function of the public key elements h, . .h,,, 
the private random elements 0^, . . . , 0]^^^, and the private message 
element m is generated as an element of which is congruent 
to 0ihi+rB2b2+ . . - +c»,5hjj+0^+m modulo the ideal Q. 

39. The method of claim 32, wherein the result A of 
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evaluating the function F of e, /i / . . - /n ^^e product e/^^^. 

40. The method of claim 32, wherein the result B of 
evaluating the function G of . . ./„ is the element a. 

41. The method of claim 32, wherein the result c in the 
set of coset representatives Cp of evaluating the function H of 

• • -fn satisfies the condition c/,j^i is congruent to b 
modulo the ideal P . 

42. The method of claim 32, wherein the result c is 
equal to the coset representatives of the message m in the set 
of coset representatives C, . 

43. The method of claim 32, wherein the ring R is a ring 
of polynomials in one variable X modulo the ideal of R 
generated by a monic polynomial M(X) of degree N, wherein the 
ideal Q of R is the ideal generated by an integer q , the ideal 

P of R is the ideal generated by an integer p , the set of 
coset representatives Cg is the set of polynomials of degree at 
most N-1 in R with coefficients in a fixed set of coset 
representatives modulo q, and wherein the set of coset 
representatives Cp is the set of polynomials of degree at most 
N-1 in R with coefficients in a fixed set of coset 
representatives modulo p . 

44. The method of claim 43, wherein the private key 
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elements fy, . . the private message element m in R, and the 

private random elements 0^, . . ^ ,a, satisfy conditions that 
include bounds on their coefficients. 

45. The method of claim 22, wherein the ring R is non- 
commutative . 

46. The method of claim 32, wherein the elements h, , . . .h^ 
are generated in Cq according to the condition that the element 
/k*ihi/Kt2 congruent in R to modulo the ideal Q for each i 
between 1 and k . 

47. The method of claim 32, wherein the private key- 
elements /j, . . . ; are in the ideal P. 

48. The method of claim 32, wherein the private random 
elements 0, , . . , . 

®2K+i satisfy the condition that the elements 
01 , . . . , 0,5 are in the ideal P . 

49. The method of claim 45, wherein the element e 
generated as a function of the public key elements h,, . . .h, , 
the private random elements 0i, . . *f02k«i/ and the private 
message element m is generated as an element of Cq which is 
congruent to m^^^^^^^^ + ^2^7^w*2'^ • ■ * '^<^k^^)e0ak'*"^2k*i + ^ modulo the 
ideal 

50. The method of claim 32, wherein the ring R is a ring 
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of matrices with integer coefficients, the ideal Q of R is the 
ideal consisting of all matrices divisible by a fixed integer 
q, the ideal P of R is the ideal consisting of all matrices 
divisible by a fixed integer p , that the set of coset 
representatives Cq is the set of elements of R with 
coefficients in a fixed set of coset representatives modulo q, 
and that the set of coset representatives is the set of 
elements of R with coefficients in a fixed set of coset 
representatives modulo p. 

51. The method of claim 50, wherein the private key 
elements f f^f the private message element m, and the 
private random elements / . . . ,o, satisfy conditions that 
include bounds on their coefficients. 

52. The method of claim 50, wherein the private random 
elements o^, . * , ;0, satisfy the condition that 0^, . . . ,0, are 
constant multiples of the identity matrix. 

53. The method of claim 32, wherein the ring R is a 
group ring of a group G , the ideal Q of R is the ideal 
generated by an integer q , the ideal P of R is the ideal 
generated by an integer p , the set of coset representatives Cq 
is the set of elements of R with coefficients in a fixed set 
of coset representatives modulo q, and that the set of coset 
representatives C, is the set of elements of R with 
coefficients in a fixed set of coset representatives modulo p . 
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54. The method of claim 53, wherein the private key- 
elements f , . . ,f, , the private message element m, and the 
private random elements Oj, . . . ,o, satisfy conditions that 
include bounds on their coefficients. 

55. The method of claim 32, wherein the ring R is a non- 
commutative ring of polynomials in two variables X and Y 
subject to the dihedral relations X** = 1, = l, and XY = YX"- 

1 , the ideal Q of R is the ideal generated by an integer q , the 
ideal P of R is the ideal generated by an integer p , the set 
of coset representatives is the set of polynomials in R of 
degree at most N - 1 in the variable X with coefficients 
chosen from a set of coset representatives modulo q, and 
wherein the set of coset representatives Cp is the set of 
polynomials in R of degree at most N - 1 in the variable X 
with coefficients chosen from a fixed set of coset 
representatives modulo p. 

56. The method of claim 55, wherein the private key 
elements . . . , f^f the private message element m, and the 
private random elements 0^, . . . , satisfy conditions that 
include the condition that some of them lie in the commutative 
subring Rq of R consisting of all elements ^ of R which satisfy 
the condition Y^ = ^Y. 
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